{"id":"https://openalex.org/W7140300304","doi":"https://doi.org/10.48550/arxiv.2603.22928","title":"SoK: The Attack Surface of Agentic AI -- Tools, and Autonomy","display_name":"SoK: The Attack Surface of Agentic AI -- Tools, and Autonomy","publication_year":2026,"publication_date":"2026-03-24","ids":{"openalex":"https://openalex.org/W7140300304","doi":"https://doi.org/10.48550/arxiv.2603.22928"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.22928","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.22928","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.22928","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5038019914","display_name":"Ali Dehghantanha","orcid":"https://orcid.org/0000-0002-9294-7554"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dehghantanha, Ali","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5020400706","display_name":"Sajad Homayoun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Homayoun, Sajad","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.30720001459121704,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.30720001459121704,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.2159000039100647,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.06620000302791595,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autonomy","display_name":"Autonomy","score":0.516700029373169},{"id":"https://openalex.org/keywords/action","display_name":"Action (physics)","score":0.4494999945163727},{"id":"https://openalex.org/keywords/verifiable-secret-sharing","display_name":"Verifiable secret sharing","score":0.43560001254081726},{"id":"https://openalex.org/keywords/attack-surface","display_name":"Attack surface","score":0.412200003862381},{"id":"https://openalex.org/keywords/taxonomy","display_name":"Taxonomy (biology)","score":0.3919000029563904},{"id":"https://openalex.org/keywords/agency","display_name":"Agency (philosophy)","score":0.38760000467300415},{"id":"https://openalex.org/keywords/privilege","display_name":"Privilege (computing)","score":0.36730000376701355},{"id":"https://openalex.org/keywords/collusion","display_name":"Collusion","score":0.35260000824928284}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6013000011444092},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5428000092506409},{"id":"https://openalex.org/C65414064","wikidata":"https://www.wikidata.org/wiki/Q484105","display_name":"Autonomy","level":2,"score":0.516700029373169},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.4494999945163727},{"id":"https://openalex.org/C85847156","wikidata":"https://www.wikidata.org/wiki/Q59015987","display_name":"Verifiable secret sharing","level":3,"score":0.43560001254081726},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.412200003862381},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.3919000029563904},{"id":"https://openalex.org/C108170787","wikidata":"https://www.wikidata.org/wiki/Q3951828","display_name":"Agency (philosophy)","level":2,"score":0.38760000467300415},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.36730000376701355},{"id":"https://openalex.org/C2781198186","wikidata":"https://www.wikidata.org/wiki/Q701521","display_name":"Collusion","level":2,"score":0.35260000824928284},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3174000084400177},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.3100000023841858},{"id":"https://openalex.org/C13687954","wikidata":"https://www.wikidata.org/wiki/Q4826847","display_name":"Autonomous agent","level":2,"score":0.30889999866485596},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3043000102043152},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2964000105857849},{"id":"https://openalex.org/C76178495","wikidata":"https://www.wikidata.org/wiki/Q4808784","display_name":"Asset (computer security)","level":2,"score":0.2782000005245209},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.2759000062942505},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.26570001244544983},{"id":"https://openalex.org/C29122968","wikidata":"https://www.wikidata.org/wiki/Q1414816","display_name":"Incentive","level":2,"score":0.2621999979019165},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.25119999051094055},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.22928","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.22928","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.22928","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.22928","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.48601943254470825,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Recent":[0],"AI":[1,23,117,185,203],"systems":[2,96],"combine":[3],"large":[4],"language":[5],"models":[6,122],"with":[7],"tools,":[8],"external":[9],"knowledge":[10],"via":[11],"retrieval-augmented":[12],"generation":[13],"(RAG),":[14],"and":[15,45,66,85,90,110,123,126,153,159,176,191,212,215,226,229],"even":[16],"autonomous":[17,202],"multi-agent":[18,67],"decision":[19],"loops.":[20],"This":[21],"agentic":[22,49,95,184,234],"paradigm":[24],"greatly":[25],"expands":[26],"capabilities":[27],"-":[28],"but":[29],"also":[30],"vastly":[31],"enlarges":[32],"the":[33,42,162],"attack":[34],"surface.":[35],"In":[36],"this":[37],"systematization,":[38],"we":[39,75,172,195],"map":[40],"out":[41,161],"trust":[43],"boundaries":[44],"security":[46,138,180,231],"risks":[47,232],"of":[48,57],"LLM-based":[50],"systems.":[51],"We":[52,92,119,219],"develop":[53],"a":[54,71,178],"comprehensive":[55],"taxonomy":[56],"attacks":[58],"spanning":[59],"prompt-level":[60],"injections,":[61],"knowledge-base":[62],"poisoning,":[63,109],"tool/plug-in":[64],"exploits,":[65,106],"emergent":[68],"threats.":[69,118],"Through":[70],"detailed":[72],"literature":[73],"review,":[74],"synthesize":[76],"evidence":[77],"from":[78],"2023-2025,":[79],"including":[80],"more":[81],"than":[82],"20":[83],"peer-reviewed":[84],"archival":[86],"studies,":[87],"industry":[88],"reports,":[89],"standards.":[91],"find":[93],"that":[94,113],"introduce":[97],"new":[98],"vectors":[99],"for":[100,182],"indirect":[101],"prompt":[102],"injection,":[103],"code":[104],"execution":[105],"RAG":[107],"index":[108],"cross-agent":[111],"manipulation":[112],"go":[114],"beyond":[115],"traditional":[116],"define":[120],"attacker":[121],"threat":[124],"scenarios,":[125],"propose":[127],"metrics":[128],"(e.g.,":[129],"Unsafe":[130],"Action":[131],"Rate,":[132],"Privilege":[133],"Escalation":[134],"Distance)":[135],"to":[136,223],"evaluate":[137],"posture.":[139],"Our":[140],"survey":[141],"examines":[142],"defenses":[143],"such":[144],"as":[145],"input":[146],"sanitization,":[147],"retrieval":[148],"filters,":[149],"sandboxes,":[150],"access":[151],"control,":[152],"\"AI":[154],"guardrails,\"":[155],"assessing":[156],"their":[157],"effectiveness":[158],"pointing":[160],"areas":[163],"where":[164],"protection":[165],"is":[166],"still":[167],"lacking.":[168],"To":[169],"assist":[170],"practitioners,":[171],"outline":[173,196],"defensive":[174],"controls":[175],"provide":[177],"phased":[179],"checklist":[181],"deploying":[183],"(covering":[186],"design-time":[187],"hardening,":[188],"runtime":[189],"monitoring,":[190],"incident":[192],"response).":[193],"Finally,":[194],"open":[197],"research":[198],"challenges":[199],"in":[200,233],"secure":[201],"(robust":[204],"tool":[205],"APIs,":[206],"verifiable":[207],"agent":[208],"behavior,":[209],"supply-chain":[210],"safeguards)":[211],"discuss":[213],"ethical":[214],"responsible":[216],"disclosure":[217],"practices.":[218],"systematize":[220],"recent":[221],"findings":[222],"help":[224],"researchers":[225],"engineers":[227],"understand":[228],"mitigate":[230],"AI.":[235]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-03-26T00:00:00"}